In the processes of setting up continuous deployment for an open source project with Travis I came across a predicament, can the encrypted private key be easily exfilitrated? For context, the deployment workflow is:

  1. In a Travis build job, build and test code
  2. If it passes, deploy the code
  3. Decrypt the encrypted private SSH key and start the SSH client
  4. Push to the Git remote on the production server

Using travis encrypt-file deploy_rsa --add, the private key is encrypted and only decryptable within the Travis build job. Am I correct in the assumption that someone forking the repo and creating a Travis build job will not be able to decrypt the key? In addition, the only attack vector would be for someone with push rights to modify the .travis-ci script to decrypt the key and send it to themselves?

  • 1
    Fork, add a dump of the key somewhere in the build, make a pull request, if pull requests are built the key will be shown in the public build log of Travis... – Tensibai Feb 17 '18 at 19:28
  • 1
    This is not the case, at least for Travis docs.travis-ci.com/user/pull-requests/… – Moritz Feb 17 '18 at 22:16
  • So you have your answer :) (but the Travis-ci file is still not the only attack vector for someone allowed to push) – Tensibai Feb 18 '18 at 8:29
  • What else should I consider? – Moritz Feb 18 '18 at 15:29
  • Whatever build system is used, scripts, even the code could exfil datas during unit tests, usually that's not a real concern on open source projects and/or build and deploy are separated. Some quality test of code (sonar/checkmark) can test for suspicious patterns also – Tensibai Feb 18 '18 at 16:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.